New ICCT report: Russia continues hybrid activities against Europe, including Serbs

The International Centre for Counter-Terrorism (ICCT) has published its latest report confirming that Russia is systematically waging a hybrid war against Europe. In collaboration with GLOBSEC, researchers have documented new incidents of sabotage, diversion and destabilization, which – according to the report – are carried out through a network of intermediaries, criminal groups and “single-use agents”.

From February 2022 to February 2026, 151 incidents linked to Russian activities were identified across Europe. In the most recent period alone, 41 new cases have been recorded, while security services estimate that the real number is significantly higher.

In Germany, for example, up to 320 suspected sabotage attempts were recorded during 2025.

Poland and the Baltic states under attack: Ukraine's allies are the target

The geographic map of incidents clearly shows a pattern: countries that strongly support Ukraine are at the top of the list of targets.

Poland leads with 31 incidents, followed by France (20), Lithuania and Germany (15 each), the United Kingdom (12) and Estonia (11). The Baltic states, which Moscow continues to view through its imperialist “sphere of influence” doctrine, account for almost a fifth of all recorded cases.

The report suggests that the intensity of support for Ukraine is a key factor in selecting targets – which confirms that the Kremlin uses destabilization as a political pressure instrument.

The Balkans as a logistical backdrop for operations

The case of a group of 11 Serbian citizens, arrested in September 2025, has attracted particular attention. According to investigative data, they have moved to several European countries and are linked to incidents aimed at inciting religious and ethnic polarization.

Among the recorded actions are the vandalism of Jewish buildings in Paris, provocative installations near the Brandenburg Gate and incidents in front of religious buildings. French authorities link the activities of this group to foreign interference and Russian interests. The report emphasizes that part of the training is suspected to have been carried out on the territory of Serbia, while one person remains at large.

According to ICCT analysts, this case shows how regional networks and individuals from Southeast Europe are used as operational channels for Moscow's broader geopolitical objectives.

Assassinations, propaganda and sabotage of infrastructure

Four Russian citizens suspected of planning an assassination attempt on dissident Vladimir Osetkin, founder of the Gulagu.net organization, have been arrested in France.

French authorities have also uncovered the activities of the SOS Donbass association, which is suspected of spreading propaganda and gathering information in favor of Russian interests.

Attempts to send incendiary devices to Ukraine have been prevented in Poland and Romania, while an attack on railway infrastructure linked to individuals close to Russian intelligence structures has been recorded in eastern Poland.

The report dispels the stereotype of “professional agents.” A full 95 percent of the identified perpetrators are civilians with no formal ties to Russian security services. The motive in almost all cases was financial.

Recruitment, according to researchers, takes place through social networks such as TikTok and Telegram. Among the perpetrators are minors, people with criminal records and individuals in difficult socio-economic conditions. About 15 percent of them openly express pro-Russian positions, while the majority act for financial reasons.

What remains worrying is the fact that about half of the perpetrators are not residents of the country where the attack is carried out – they travel specifically to carry out the act and return immediately, mainly from countries in Central, Eastern and Southern Europe.

According to the ICCT, the model used by Moscow relies on a decentralized network of criminal groups and vulnerable individuals who operate for relatively small amounts of money, but produce a disproportionate effect in terms of security and politics.

The report highlights that Europe is facing an ongoing destabilization campaign, where propaganda operations, infrastructure sabotage, and assassination attempts are part of a broader pressure strategy.

While the war in Ukraine rages on the front lines, according to this report, a parallel war against European stability is being waged silently – through networks that cross borders and exploit system vulnerabilities across the continent.

/The Geopost/